PT-2026-56481

CVE-2026-54344

Published

2026-07-08

Updated

2026-07-08

Description by

CVSS 3.1

8.8

High

MetricsAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.20.180

Description The render preview deployment workflow interpolates the github.event.comment.body variable directly into a bash conditional within a run step. This allows a GitHub user with permission to comment on an open pull request to execute arbitrary shell commands on the CI runner and exfiltrate deployment secrets.

Recommendations Update to version 3.20.180.

Exploitability

Exploit

Fix

Impacts

Researchers

Avivdon

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers